InvoiceStars

Privacy Policy

Last updated October 20, 2026

InvoiceStars is run by Matthew Sidlo, 375 Waterman Ave, East Providence, RI 02914, USA. Questions: support@invoicestars.com.

The short version

InvoiceStars reads your QuickBooks Online payments and invoices so it can ask the right customer for a Google review once an invoice is paid in full. We only read QuickBooks data. We never change it. We don't sell data or use it for ads.

What we read from QuickBooks

• Payments, invoices and sales receipts: to see when an invoice is paid in full (balance $0). Partial payments and deposits are ignored.
• Customers: name, email address and phone number of the customer on that invoice, so we know who to ask.
• Your Intuit user: when you connect, Intuit tells us the email and user ID of the person who authorized the connection. We keep this as a record of who connected.

We get this through Intuit's official API, using access you grant with "Connect to QuickBooks." Changes reach us by Intuit's notifications and a check every 15 minutes.

What we store

• Your account: your email, business name, settings (review link, delay, message text) and plan status.
• QuickBooks connection: the access tokens and your company ID, encrypted. Lookups use a one-way fingerprint of the company ID.
• Review requests: for each paid invoice, the invoice number, customer name, the email or phone we'll use, status (waiting for approval, sent, skipped and why), when it was sent and whether the review link was clicked.
• Unsubscribes: email addresses that asked not to be contacted, so we never email them again.
• Waitlist: your email if you joined it.
• Sign-in: a short-lived one-time sign-in link and a session cookie that keeps you signed in. Admins have a separate cookie.

We don't store full QuickBooks invoices, amounts or line items.

Emails we send

• To your customers, in your business's name: one review request after an invoice is paid in full, and at most one reminder if they didn't click. Each one has a one-click unsubscribe link. We skip accounts-payable and billing inboxes (like ap@ or billing@), and we don't ask the same customer twice within 90 days.
• To you: sign-in links, trial tips and billing notices. Trial tips include an unsubscribe link.

SMS isn't switched on yet. If it is added, it will only go to customers who agreed to texts, and replying STOP will end them.

Who processes data for us

• Cloudflare: hosting, database and our email forwarding (USA account).
• Intuit: the QuickBooks connection.
• Resend: sends our emails.
• Stripe: payments. Stripe holds your card details; we only keep your Stripe customer and subscription IDs.
• Google: the review link you give us points to Google. The planned Review Score checker would look up businesses through Google.

Security

Everything travels over HTTPS. QuickBooks tokens and company IDs are encrypted (AES-256-GCM) with a key kept separately from the database.

Disconnecting and deleting

• Disconnect QuickBooks from your dashboard (or from the QuickBooks app list) at any time. We revoke our access with Intuit, delete the stored tokens, and cancel any review requests that weren't sent yet.
• To delete your account and data, email support@invoicestars.com from your account email. We confirm the request and complete it within 30 days: we revoke our QuickBooks access, then delete your account, the stored QuickBooks tokens and connection, your review-request records, sign-in links, and trial-email records. We keep only a note that an account number was deleted and when, with no personal details. We also cancel any subscription in Stripe; Stripe keeps its own payment records as the law requires.
• How long we keep data: while your account is open. We haven't set a fixed retention period for old review-request records yet; this section will be updated when we do.

Changes

We'll update this page and email account owners about material changes.